1

Windows server 2019 with CA role, made a certificate template and enabled the option "CA certificate manager approval" in it, then issued it on my CA server. now on a client I went to the personal certificate store and requested that certificate, filled up the info and sent the enrollment request to the CA server. CA server received it in its pending requests list, then i issued it, restarted the client machine, but the request is still in this certificate store on the client machine (picture below), the personal store is empty. how long it's gonna take for the client to finally receive this certificate?

I'm Not using group policy auto enrollment because none of my certificate templates are set to be auto enrolled. i want to manually issue/deny the certificate requests on my CA server.

enter image description here

Improve this question

1 Answer 1

Reset to default
2

With the approval based cert workflow you have setup, your client will never actually go fetch the approved certificate on its own. You have to do that step manually as well.

On your CA, lookup the request ID number for the request you're trying to complete if you don't already know it. Then run the following from an elevated shell on your client:

certreq -retrieve -config "<CA FQDN>\<CA Name>" <request ID> mycert.crt
certreq -accept mycert.crt

Optionally, you can leave out the -config blah stuff and the command will pop up a GUI dialog to choose the CA you want to retrieve the cert from.

Improve this answer
2
  • I did what you said, only typed in the "certreq -retrieve" on the client but i got an error saying parameter is invalid. but i figured it out another way. so i enabled auto enrollment group policy, in the certificate's security tab added the user group that the certificate was intended for and enabled auto enroll only for that specific group, now i can manually approve the requests and clients automatically fetch the answer from my CA server.
    – user299093
    Aug 9, 2019 at 19:40
  • With just certreq -retrieve, you still need at least the request ID. So it would be something like certreq -retrieve 25.
    – Ryan Bolger
    Aug 9, 2019 at 20:41

You must log in to answer this question.